Red Hat Product Security has identified two vulnerabilities in PostgreSQL 12 related to arbitrary code execution during database restore operations (CVE-2025-8714 and CVE-2025-8715). These vulnerabilities affect PostgreSQL packages distributed with Red Hat Enterprise Linux 8.6 variants including Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory (RHSA-2025:15006) provides updated packages to fix these issues. The vulnerabilities are categorized under CWE-829 and CWE-93, indicating improper control of code execution during restore. No CVSS base score is provided, but the severity is considered important/high by Red Hat. No exploits in the wild are currently known.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code during the PostgreSQL restore operation, potentially compromising the affected system. This could lead to unauthorized code execution with the privileges of the PostgreSQL process. The advisory rates the security impact as important, indicating a high severity level. No known active exploits have been reported at this time.

Red Hat has released updated PostgreSQL 12 packages for Red Hat Enterprise Linux 8.6 variants to address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:15006 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation actions are indicated by the vendor.